Developer platform Railway urges ‘all users’ to revoke secret keys after cyberattack
Developer platform Railway has urged all users to rotate their API and cloud keys following a cyberattack that potentially exposed encrypted environment variables. The company has paused deployments while investigating the breach, which may be linked to broader attacks on AI inference providers.
Why it matters
The incident highlights the ongoing security risks to cloud development platforms and the potential for supply-chain attacks targeting AI infrastructure.
Development platform Railway has confirmed that a cyberattack allowed hackers to access some customer secrets, prompting the company to urge all users to rotate their API and cloud keys amid fears of a broader breach of customer data.
The company, which allows customers to build apps and services on its cloud development platform, said in a blog post on Wednesday that the unidentified hackers “may have accessed encrypted environment variables and, for some of them, obtained the decrypted contents.”
These environment variables are typically lists of passwords and API keys that are used by the developer’s apps to access other services, such as cloud data storage and databases. With these customer secrets, an attacker could also log in and access data as if they were the rightful owner.
Get smarter about the news
Sign up free for a feed built around what you actually care about, Dive Deeper research on any story, and the full text of every article.
Create free accountAlready have an account? Sign in